ExLlamaV3’s EXL3 loader uses an index supplied by the model itself to choose a CUDA kernel without verifying that the index is within bounds. If a malicious model supplies a negative or otherwise out‑of‑range index, the loader can read and call a function pointer that does not belong to the allowed kernel table, which can cause a crash and, under particular host memory layouts, may allow the attacker to trigger a controlled indirect kernel dispatch during model load. The resulting vulnerability can compromise the confidentiality and integrity of the system by executing code in kernel space, and can lead to a denial of service through a reproducible crash.

Turboderp-org’s ExLlamaV3 is affected. No specific version information is provided, so any install that includes the EXL3 loader is potentially vulnerable.

The lack of a bounds check makes the issue technically high severity, but exploitability depends on the attacker’s ability to supply a malicious model and on the host memory layout. With a CVSS score of 9.8, the risk is weighed as critical. EPSS is <1%, and the vulnerability is not listed in CISA KEV, so current public exploitation activity is unknown. The likely attack vector involves an attacker delivering a crafted model to the application, which then loads the model locally or via an API. If the application accepts untrusted models, this presents a local or remote kernel‑mode code‑execution risk.